Active Directory on Zachary Loeber's Blog

PowerShell: AzureAD Dynamic Groups

Sun, 04 Feb 2018 17:36:57 +0000

A few code snippets for Azure AD dynamic groups. One for creating standard groups for your environment. Another for finding duplicates.

Powershell: New-ADPasswordReminder

Thu, 13 Oct 2016 19:03:55 +0000

A single, self-extracting, self-scheduling, AD password change notice PowerShell script.

Powershell: New-ADPasswordReminder

Thu, 13 Oct 2016 19:03:55 +0000

A single, self-extracting, self-scheduling, AD password change notice PowerShell script.

Exchange: Stop Email Exfiltration

Fri, 25 Sep 2015 01:41:25 +0000

When your users leave or get removed from the organization they may still be getting company confidential information. Here is how you can find out and stop this from happening.

Exchange: Stop Email Exfiltration

Fri, 25 Sep 2015 01:41:25 +0000

When your users leave or get removed from the organization they may still be getting company confidential information. Here is how you can find out and stop this from happening.

Powershell: WPF/Treeview OU Selection Dialog

Sun, 22 Mar 2015 16:13:54 +0000

This is a self-contained organizational unit selection dialog box using powershell, xaml, wpf, and ADSI. Should be useful in any number of one off Powershell projects I imagine.

Exchange 2013: Server Component State Script

Tue, 09 Dec 2014 01:28:23 +0000

Exchange 2013 includes some powershell commands which allow you to set and view several components in the messaging infrastructure. This is important to be aware of as it means all Exchange related services can be running when looking at them in service manager (services.msc) but not actually doing anything. I went ahead put together a script to better gather this information for administrators.

Exchange 2013: Server Component State Script

Tue, 09 Dec 2014 01:28:23 +0000

Lync and UM Correlation with Powershell

Fri, 14 Nov 2014 03:31:13 +0000

I’ve been working on an Exchange/Lync voice deployment lately and have found a new level of frustration for the lack of connectivity between the several voice components involved in turning up such a solution. That being said it is not very difficult to validate your deployment with a bit of Powershell.

There are a few necessary results to gather where I believe it can be easy to ‘miss’ configuration steps when turning up or disabling users:

Exchange: Receive Connector Tango! – Part 2

Sat, 23 Aug 2014 21:20:31 +0000

In part 1 of this series I discussed some basic knowledge requirements to get a better grip on receive connectors in Exchange. I continue that conversation with some examples of improperly configured connectors and the issues they may cause. I finish up the discussion with a script you can use to scan your environment for such configurations.

Exchange: Auto Batching 2013 Migrations

Mon, 28 Jul 2014 16:48:24 +0000

Here is a quick script I put together for automatically creating Exchange 2013 mailbox migration batches. This is useful for the final stages of an Exchange 2013 upgrade among other things.

Exchange: Auto Batching 2013 Migrations

Mon, 28 Jul 2014 16:48:24 +0000

Here is a quick script I put together for automatically creating Exchange 2013 mailbox migration batches. This is useful for the final stages of an Exchange 2013 upgrade among other things.

Exchange: Receive Connector Tango! – Part 1

Mon, 07 Jul 2014 03:25:13 +0000

Exchange receive connectors are often configured incorrectly or worse, insecurely. This is the first of a two part series about Exchange receive connectors and what to look out for when setting them up.

Powershell Tip – Connecting With ADSI to Another Forest

Fri, 11 Apr 2014 21:17:43 +0000

Using a bit of Powershell and ADSI it is pretty easy to connect to another forest. Finding out how to do so is not very clear though. Here is what I came up with to accomplish this task.

AD Audit Report with Powershell: Part 3

Sat, 11 Jan 2014 04:16:29 +0000

This is my third and final major update to my AD auditing script. This includes a handful of new useful sections such as domain published printers, NPS servers, DHCP servers, as well as SCCM sites and DPs. Other improvements include easier to use script parameters and bug fixes.

AD Audit Report With Powershell: Part 2

Sat, 02 Nov 2013 17:41:25 +0000

I’ve updated my AD auditing report. The forest level report now includes AD integrated zones, GPOs, and fixed code to conform to strict v2 Powershell. I’ve also included a new domain level report! This report provides some user/group stats, all privileged group membership, and more.

Active Directory Audit Report With Powershell

Fri, 18 Oct 2013 15:13:11 +0000

Not too long ago I wrote a quick post on how easy it is to gather information from AD. As a case in point example I provided a script to gather all the disabled user accounts which are still assigned Lync IDs. In this script I take it one step further and provide a full blown Active Directory reporting script which can be produced with any non-privileged domain user account.

Visualize Active Directory Site Connections

Sun, 06 Oct 2013 22:50:35 +0000

In this post I use powershell with graphviz to create an Active Directory diagram of all site connections between servers. Additionally, I’ve included some code which displays site connection options. You may be able to use this to find isolated DCs or just to see a pretty diagram.

Find Disabled Users With Lync Enabled Without Lync Cmdlts

Mon, 30 Sep 2013 21:19:15 +0000

Here is a quick tip which applies to more than just Lync. I use powershell with .NET ADSI to gather a list of all users which are disabled but still have Lync sip addresses assigned. There are numerous reasons to disable lync on such accounts. One reason would be to make certain that users whom are no longer with the organization get removed from the Lync address list. Another is so these same users can no longer access Lync! (Yes, a disabled AD account may still be authorized to access Lync).

Excel and HTML Asset Reports With Powershell

Sun, 08 Sep 2013 05:07:29 +0000

This set of powershell functions collates and generates reports upon system information it gathers. Information gathered includes hardware health, system information, networking information and much much more. Multiple types of html reports can be generated and all data can be exported directly to an excel workbook, saved as individual reports, and emailed.

Gather Applied GPOs from Remote Systems With Powershell

Wed, 04 Sep 2013 04:16:09 +0000

Gather the applied GPO information for one or more systems using wmi, alternate credentials, and multiple runspaces. Function supports custom timeout parameters in case of wmi problems and returns GPO name, applied order, source, no override settings, and more. You can view verbose information on each runspace thread in realtime with the -Verbose option.

Audit User Profile Folders With Powershell

Fri, 21 Jun 2013 18:46:09 +0000

This function will aggregate sub-folders within a folder on a server and attempt to associate them with user IDs within a domain and provide additional information. This script can also be used to move folders for disabled or non-existent accounts.

Exchange: Mailbox GUI

Mon, 08 Apr 2013 01:10:21 +0000

Exchange 2010 Mailbox GUI

A powershell GUI for selecting and performing actions against multiple Exchange mailboxes.

Exchange – The State Of External Client Access

Thu, 22 Nov 2012 19:58:04 +0000

Introduction

Most within the messaging and collaboration industry are hyped up about the next wave of Microsoft collaboration and messaging products which are soon to be released. Among these products is Exchange 2013 RTM. This type of release typically precedes yet another wave of architecture upgrades across the corporate landscape. Some of these (beta testers) will be will undoubtedly upgrade to Exchange 2013.

Other corporations will start to feel the burn to upgrade as well. These will be organizations which realize that their Exchange 2003/2007 infrastructure is nearing a decade old existence and cannot meet the demands of their ever growing mobile workforce. Realizing they are behind the curve, they may feel hastened to upgrade as well, possibly just to Exchange 2010. Regardless the reason in choosing to upgrade their messaging infrastructure, there are critical design decisions which need to be made in how clients access this infrastructure both internally and externally. This article focuses solely on the external access aspect of the infrastructure.

Exchange: Automatically Generating Configuration Scripts

Sat, 29 Sep 2012 17:33:20 +0000

I’ve started a side project which is born from personally having to redo many aspects of an Exchange migration over and over again. Most of this, I believe, can be automated. Some aspects of this process include exchange server role prerequisite procedures, co-existence configuration, DAG/CAS configuration, and other general reminders and processes.

Exchange 2010: Even More Migration Tips

Wed, 11 Jul 2012 00:34:32 +0000

It has been a while since I passed on some personal experiences when performing Exchange 2010 migrations. I thought it was about time to update my list to include some more of the lesser known aspects of an Exchange 2010 migration.

Active Directory: Best Practices Workbook

Mon, 28 May 2012 21:57:58 +0000

This is a checklist for technicians performing Active Directory assessments. It is broken down by category and best practice. Some items listed are not really a best practice, but rather something which you may find in an environment which should be rectified (as part of an audit perhaps).

Create Your Own Network Assessment Appliance

Mon, 09 Apr 2012 00:49:19 +0000

In this write-up I setup several network assessment tools which can be used in the discovery process of a new environment. This can be useful for a newly hired sysadmin or a consultant in rapidly gathering information to assess the health and/or state of a network.

Introduction

I often find myself assessing a foreign network infrastructure for performance or other issues. Depending on the size of the environment, digesting everything can be daunting without the help of some third party tools. I’ve been using a custom Linux VM on my workstation that has all kinds of tools specifically for gathering information about a network’s performance, layout, and statistics. I’ve decided to retool the VM I currently use and take better notes on what I install so others may do the same if they so desire.

Sysadmin Task: Migrate DNS

Sat, 24 Mar 2012 16:07:54 +0000

I’ve migrated DNS servers more than a few times and find that I’m doing the same tasks or using the same custom scripts over and over again. Here is my quick and dirty task list with some powershell scripts you too might find of use. As there are a hundred ways to skin this cat I don’t claim my methods to be the best but they sure are fast and far easier than manually changing a dns address on hundreds of servers, workstations, and network devices.

Assessing Like A Microsoft Technician

Sat, 10 Mar 2012 03:08:26 +0000

Troubleshooting Like A Microsoft Technician

I have been doing more and more site assessments for Active Directory, Exchange, Lync, and VMware. As such, I’ve been slowly refining the toolset that I use to gather data and troubleshoot existing environment issues. Here is a list of site assessment tools I’m finding that I regularly return to for rapid analysis or information gathering at a site. All of these tools are free.

Exchange 2010: Changing an invalid DNS suffixed server

Thu, 01 Mar 2012 05:30:13 +0000

I ran into an interesting Exchange 2010/2007 co-existence issue today. After a new Exchange 2010 (all-in-one) server was introduced into the environment traffic would only flow from the 2010 server to the 2007 hub/cas server and not the other way around. The mail queues stated the last error to be

“Initial error: 451 4.4.0 dns query failed. The error was: SMTPsend.dns.nonexistentdomain; nonexistent”

Active Directory: Essential Tools

Thu, 11 Aug 2011 18:35:00 +0000

During my many years of working with active directory I’ve used several tools. Here are some of the best that I’ve used which are not baked into windows. Good thing about this list is that most of these tools are fee! Another bonus is that most of the information gathering tools don’t require elevated rights as, by default, domain users have read-only access to active directory.

Exchange 2010: Protect VIP Mailboxes with Exclusive Scopes

Wed, 04 May 2011 21:26:37 +0000

Prior to starting my new job I wanted to ensure that my previous employer was able to protect VIP mailboxes in their Exchange 2010 SP1 organization. I had to do this with exclusive scopes and these are the steps I had to follow. A general knowledge of role based security is assumed in this post.

Windows: 2003 to 2008 R2 RADIUS Migration

Thu, 17 Mar 2011 12:58:12 +0000

I found myself doing yet another Windows 2003 IAS Radius server migration to 2008 R2 NPS. I found that I had my prior notes and was able to do this quickly but, hell, if I’m looking this up in my own notes I may as well just post this succinct little procedure.

Windows: 2003 to 2008 R2 RADIUS Migration

Thu, 17 Mar 2011 12:58:12 +0000

Active Directory: Role Based Access Modeling

Tue, 22 Feb 2011 04:22:28 +0000

Much of my time is spend delving into the minutia of a particular technology to resolve issues or improve department processes. But sometimes understanding and implementing a technology is not the best “fix” for an issue. Sometimes it is a mindset or a model that needs to change. I came up with this security grouping model to address some of the pains of managing permissions across large groups of systems in our environment. Ok, I modified a long standing Microsoft recommendation of AGDLP (an abbreviation of “account, global, domain local, permission”) to meet our needs. Regardless here is a quick rundown of this security group model I devised if anyone is interested.

Outlook 2010: Photo Sizing Tool

Tue, 01 Feb 2011 15:35:24 +0000

We are about to get into full swing with our Exchange 2010 mailbox migrations and, soon afterwards, Office 2007 to 2010 upgrades as well. Unfortunately, we don’t have our Sharepoint farm upgraded to 2010 yet so there will be no automatic syncing of user photos into the GAL for those nice vanity pics which you can view in Outlook 2010. I know people like to be seen so I found a nice powershell based GUI for our (awesome) service desk team to use to upload these photos for users as requested. But you still have to get these photos thumbnailed to approximately 96×96 before uploading. Repeated manual labor is the anathema of any self respecting sysadmin who knows how to hack other people’s code to suit their needs. So I whipped up a very dirty (as in, “wow, get the bar of soap” dirty) hack which combines this person’s clever photo-sizing hack with the prior mentioned gui.

Exchange: Remove entire OU from address book

Sat, 22 Jan 2011 17:51:51 +0000

Here is another script that I hacked together in part of an AD/Exchange cleanup task to remove disabled users from the address book. This script, more specifically, removes an entire OU of users from the address book, so make sure that all the users are disabled in the OU you will be running this against! 🙂

Exchange: Remove entire OU from address book

Sat, 22 Jan 2011 17:51:51 +0000

Big-IP: Sharepoint 2010 Monitor

Fri, 21 Jan 2011 15:08:24 +0000

While specing out a Sharepoint 2007 to 2010 migration I discovered that the default monitor created by the application template on our big-ip LTM load balancers does not work. In seeking a solution I ran across this gentleman’s blog with a custom external monitor but found that it didn’t really work. The solution to make it work was simple (as I explained on his blog in a comment). I went ahead and extended it to be more environment generic.

Exchange – Notify Forwarded Accounts Script

Mon, 10 Jan 2011 20:00:19 +0000

In cleaning up a large number of disabled user accounts in AD I wanted a way to notify a large number of users specifically that they were being forwarded e-mail from another account. This was part of an effort to clean up AD a bit before moving everyone over to Exchange 2010 but it can be used independently of any one project as part of a general AD maintenance plan.